# Signing key and encryption key are the same

**URL:** <https://forum.keycloak.org/t/signing-key-and-encryption-key-are-the-same/18880>\
**Category:** Getting advice\
**Tags:** saml\
**Created:** [December 8, 2022, 5:02pm UTC](https://forum.keycloak.org/t/signing-key-and-encryption-key-are-the-same/18880 "2022-12-08T17:02:47Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Michal](https://avatars.discourse-cdn.com/v4/letter/m/34f0e0/32.png) [@Michal](https://forum.keycloak.org/u/Michal)\
**Post date:** [December 8, 2022, 5:02pm UTC](https://forum.keycloak.org/t/signing-key-and-encryption-key-are-the-same/18880/1 "2022-12-08T17:02:48Z")

</div>

Hello, I have a problem with saml different keys for signing and encrypting. I would like to have different but keycloak constantly gives me the same. What I did: In Realm settings → Keys → Providers → Add keystore I created RSA and RSA-ENC providers with uploaded different key and certificate. But when I click in keycloak on Identity Providers → click on provider → and click in Enpoints on value I see Servis provider endpoint xml with signing and encryption with the same key. Signing key is used for encryption. Is any way how to have different keys, please?

---

<div class="post-metadata">

**Author:** ![roiebe](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/roiebe/32/7727_2.png) [@roiebe](https://forum.keycloak.org/u/roiebe)\
**Post date:** [February 20, 2023, 1:22pm UTC](https://forum.keycloak.org/t/signing-key-and-encryption-key-are-the-same/18880/2 "2023-02-20T13:22:49Z")

</div>

I’m using keycloak 20.0.3 and have the same issue. is it a bug?

---

<div class="post-metadata">

**Author:** ![W74Wolf](https://avatars.discourse-cdn.com/v4/letter/w/eb9ed0/32.png) [@W74Wolf](https://forum.keycloak.org/u/W74Wolf)\
**Post date:** [April 22, 2023, 7:01am UTC](https://forum.keycloak.org/t/signing-key-and-encryption-key-are-the-same/18880/3 "2023-04-22T07:01:47Z")

</div>

I am using keycloak 15.1.1 and i have the same problem is it a bug, some settings i am missing or something else. Any progress with this issue?

---

<div class="post-metadata">

**Author:** ![mms-guru](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/mms-guru/32/8344_2.png) [@mms-guru](https://forum.keycloak.org/u/mms-guru)\
**Post date:** [April 26, 2023, 9:04am UTC](https://forum.keycloak.org/t/signing-key-and-encryption-key-are-the-same/18880/4 "2023-04-26T09:04:37Z")

</div>

I’d also be interested to know if it’s possible to use different certs/keys for token signing and token encryption/decryption.